Certain REGEX strings in transforms.conf will fail

_d_ — Tue, 22 Nov 2011 15:37:02 GMT

I have requierement where i need to route data from certain sources to a specific index. The index name will be extracted from a specific location in the path when it's only preceded by a certain other segment. Example (this is a windows box - notice the path separators):

[send_to_index] REGEX = bar\\[[:alnum::]]\\ DEST_KEY = queue FORMAT = indexQueue

In this case I need to extract the path segment that comes after bar and send that path's data to the index with extract's name. The setup is simple and should work but it doesn't.

Re: Certain REGEX strings in transforms.conf will fail

_d_ — Tue, 22 Nov 2011 15:37:48 GMT

After some careful exploration I have an answer that might benefit the community. The short answer is "do not end your REGEX in backslash".
A btool --debug for the above gives the following:

splunk cmd btool --debug transforms list send_to_index system [send_to_index] system CAN_OPTIMIZE = True system CLEAN_KEYS = True system DEFAULT_VALUE = system DEST_KEY = system FORMAT = indexQueue system KEEP_EMPTY_VALS = False system LOOKAHEAD = 4096 system MV_ADD = False system REGEX = bar\\[[:alnum:]]\ DEST_KEY = queue system SOURCE_KEY = _raw system WRITE_META = False

You clearly can see that DEST_KEY is not considered by the system and consequently the setup fails. The culprit behind this appears to be that last backslash.
It turns out that in .conf files the presence of a backslash at the end of a line will escape the implied newline there.

Easy Fix - do NOT end the REGEX with backslash:

[send_to_index] REGEX = bar\\[[:alnum::]]\\\w+ DEST_KEY = queue FORMAT = indexQueue

OR, if you need a backslash there, escape it and bracket it.

[send_to_index] REGEX = bar\\[[:alnum::]][\\] DEST_KEY = queue FORMAT = indexQueue

Hope this helps.

topic Certain REGEX strings in transforms.conf will fail in Splunk Search

Certain REGEX strings in transforms.conf will fail

Re: Certain REGEX strings in transforms.conf will fail